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Abstract 

We prove that a quantum walk can detect the presence of a marked element in a graph in 
0{VWR) steps for any initial probability distribution on vertices. Here, W is the total weight of 
the graph, and R is the effective resistance. This generalizes the result by Szegedy jSOj that is only 
applicable if the initial distribution is stationary. We describe a time-efficient quantum algorithm 
for 3-distinctness based on these ideas. 

1 Introduction 

Quantum walks are of great importance in quantum algorithms. For instance, quantum walk on the 
Johnson graph has been used in many applications: fc-distinctness and fc-sum problems (11[I3], triangle 
detection in a graph given by its adjacency matrix [251 119j . matrix product verification [T^, restricted 
range associativity |16) . and others. For more examples, refer to the survey papers by Ambainis [3], 
Kempe [ID], or Santha [55] ■ 

In this paper, we deal with the problem of detecting marked vertices in a graph. Two main paradigms 
for this task, Szegedy- type quantum walks and MNRS quantum walks [21] , assume the walk is started 
in the stationary distribution. In particular, Szegedy showed that the presence of a marked vertex can 
be determined in 0{Vh) steps of the quantum walk where H is the average classical hitting time. But 
starting in the stationary distribution can be a strong limitation if the graph is complex or not given in 
advance. The main result of this paper is the generalization of the algorithm by Szegedy to arbitrary 
initial distribution. In order to do so, we add two new ingredients to the analysis of Szegedy-type 
quantum walks: 

Electric Networks. A point of view on a graph as an electric network has turned out very fruitful 
in the analysis of classical random walks [T71 jTU] . But it seems to be completely ignored in the 
analysis of quantum walks. The preceding papers relied on the spectral properties of the graph. 

Effective Spectral Gap Lemma. The effective spectral gap lemma is a very simple and powerful tool 
in the analysis of spectral properties of a special kind of unitary transformations [23j . This lemma 
has been used to prove the optimality of the adversary bound for quantum state conversion [23] , 
and for the implementation of span programs as quantum algorithms [Sj . We show that the lemma 
can be also applied for general quantum walks. 

We show two examples of application of this quantum walk. In Section [H we show how a general 
learning graph ,7] can be implemented as a quantum walk. In Section [S] we use these ideas in a time- 
efficient quantum algorithm for 3-distinctness. The last example is interesting as a quantum walk on 
a graph not given in advance. This is at the very heart of classical random walks: Since only local 
information is required to implement a random walk, they are often used to traverse graphs whose 
global structure is unknown (see, e.g., [HISH])- Quantum walks require more global information than 
the classical ones, and they are usually used for graphs known in advance like for the Johnson graph 
mentioned above. 

We hope the ideas presented in this paper will be useful for implementing other quantum walks. 
Possible candidates could be time-efficient implementations of learning graphs and quantum analogues 
of random- walk-based algorithms. 

The remaining part of the paper is organized as follows. In Section [51 we recall the relations between 
classical hitting time and electric resistance of a graph, and some tools from quantum algorithms. In 
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Section[31 we prove the main result, and in Section^ give an application to learning graphs. In Section[Sl 
we apply the new quantum walk algorithm for the 3-distinctness problem. 



2 Preliminaries 

2.1 Random Walks and Electric Networks 

Let G = (y, E) be a simple undirected graph with each edge assigned a weight We > 0. Let W = X^eg-E 
be the total weight. Consider the following random walk on G: If the walk is at a vertex u V, proceed 
to a vertex v with probability proportional to Wuv, i-e., Wuv/{J2ux€E^ij-x)- The random walk has a 
stationary probability distribution tt = (tTu) given by = X^uueB ^"''/(^'^)- step of the random 

walk leaves tt unchanged. 

Let cr — (cr„) be an initial probability distribution on the vertices of the graph, and let Af C y be some 
set of marked vertices. We are interested in the hitting time Ho-^m of the random walk: the expected 
number of steps of the random walk required to reach a vertex in M when the initial vertex is sampled 
accordingly to a. If a is concentrated in a vertex s E V, oi M consists of a single element t £ V , we 
often replace cr by s or M by t. For instance, we have H^j^m — X^usy <^uHu.m- We usually assume that 
G and a are known, and the task is to determine whether M is non-empty by performing the random 
walk. 

Assume M is non-empty, and define a flow on G from a to M as a real-valued function pe on the 
(oriented) edges of the graph satisfying the following conditions. At first, p^v = —Pvu- Next, for each 
non-marked vertex u, the flow satisfies 



uv^E 

That is, Uu units of the flow are injected into u, it traverses through the graph, and is removed in a 
marked vertex. Deflnc the energy of the flow as 



Clearly, the value of © does not depend on the orientation of each e. The effective resistance Rcr,M is the 
minimal energy of a flow from a to Af. For i?, as for iJ, we also replace a and M by the corresponding 
singletons. The resistance Rcr,M equals the energy dissipated by the electric flow where the edges have 
conductance We, cr„ units of the current are injected into each u, and then collected in M |10] . The 
following two results can be easily obtained from the results in Ref. [l^: 

Theorem 1. // G, w, W are as above, s, t are two vertices of G, M C V , and tt is the stationary 
distribution on G, then 

(a) the commute time between s and t, Hs^t + Ht,s, equals 2WRs^t') 

(b) the average hitting time i?^,M equals 2WRt,^m- 

We show that we obtain a quadratic improvement in the quantum case: If G and a are known in 
advance and the superposition X^ugv V^W) is given, the presence of a marked vertex in G can be 
determined in 0{-\/WR) steps of the quantum walk. By combining this result with the second statement 
of Theorem [1] we obtain the main result of the paper by Szegedy [30] ■ 

2.2 Tools from Quantum Computing 

We assume the reader is familiar with the basics of quantum computation |26[ and query complexity [llj . 
Although we use the language of electric networks to state our results, our algorithms still use spectral 
properties of unitary transformations. We start with a result we use to prove the existence of a spectral 
gap, and then we review how to detect it. 

Lemma 2 (Effective Spectral Gap Lemma |23j). Let Ha cind Hb be two orthogonal projectors in the 
same vector space, and Ra = 211^ — / and Rb = 211^ — I be the reflections about their images. Assume 
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Pq, where O > 0, is the orthogonal projector on the span of the eigenvectors of RbRa with eigenvalues 
e'^ such that \9\ < 0. Then, for any vector w in the kernel of Ha, we have 

ll^^ensii;!! < ^\\w\\. 

Theorem 3 (Phase Estimation |21l I15j). Assume a unitary U is given as a black box. There exists 
a quantum algorithm that, given an eigenvector tp of U with eigenvalue e"^ , outputs a real number w 
such that |w — 01 < S with probability at least 9/10. Moreover, the algorithm uses 0(1/6) controlled 
applications of U and |- polylog(l/(5) other elementary operations. 



3 Quantum Walk 

In this section, we construct a quantum counterpart of the random walk in Section 12.11 The quantum 
walk differs slightly from the quantum walk by Szegedy. The framework of the algorithm goes back to [5] , 
and Lemma [2] is used to analyse its complexity. We assume the notations of Section 12.11 throughout the 
section. 

It is customary to consider quantum walks on bipartite graphs. We keep with this tradition, and 
assume the graph G — {V,E) is bipartite with parts A and B. Also, we assume the support of a is 
contained in A, i.e., (T„ = for all u € B. These are not very restrictive assumptions: If either of 
them fails, consider the bipartite graph G' with the vertex set V' = V x {0,1}, the edge set E' = 
{(m, 0)(t;, 1), (u, l)(u, 0) I uv e E}, edge weights W(„_o)(ti,i) ^ ^(«,i)(d,o) ^ '"'t"" initial distribution 
'^[u 0) ~ ^^'^ '-'^ marked vertices M' — M x {0, 1}. Then, for the new graph, W — 2W, and 

R'ai,M' ^ Ra,M- 

We assume the quantum walk starts in the state <r — X^ney 1^) that is known in advance. Also, 
we assume there is an upper bound R known on the effective resistance from a to AT for all possible sets 
M of marked states that might appear. 

Now we define the vector space of the quantum walk. Let S be the support of a, i.e., the set of 
vertices u such that (T„ 7^ 0. The vectors | u G S*} U {|e) | e € E} form the computational basis of 
the vector space of the quantum walk. Let T-L^ denote the local space of it, i.e., the space spanned by 
\uv) for uv Cz E and \u) if m G 5. We have that ©ug^'Hu equals the whole space of the quantum walk, 
and "Hti equals the subspace spanned by the vectors |e) for e £ E. 

The step of the quantum walk is defined as RbRa where Ra = ®ugA ^^'-^ = ®ueB ^'"^ 
the direct sums of the diffusion operations. Each is a reflection operation in TLu- Hence, all Z?„ in 
Ra or Rb commute, that makes them easy to implement in parallel. They are as follows: 

• If a vertex u is marked, then is the identity, i.e., the reflection about "H^; 

• If u is not marked, then Z?„ is the reflection about the orthogonal complement of ipu in 'Ru, where 



' ^ uv£E 

for some constant Ci > 0. This also holds for u ^ S: For them, the first term in ^ disappears. 



Algorithm 1 The quantum walk algorithm. Here, G is some constant to be specified later. 
1: Start in the state 

2: Calculate, for each u € S, whether it is marked, and measure this bit. 
3: If the result of the measurement shows 'marked', 
4: then output "marked vertices exist", and quit. 

5: Execute quantum phase estimation on RbRa with precision 1/{G\/RW). 

6: If the eigenvalue is 1, 

7: then output "marked vertices exist" ; 

8: otherwise, output "no marked vertices" . 
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Theorem 4. Algorithm]^ detects the presence of a marked vertex with probability at least 2/3. The 
algorithm uses 0{\/KW) steps of the quantum walk. 

Proof. The second statement follows immediately from Theorem [31 Let us prove the correctness. If a 
vertex in the initial distribution is marked with probability at least 2/3, then this is detected at Step 
3 with the same probability, and we are done. So, assume this probability is less than 2/3, and the 
measurement outcome on Step 3 is 'not marked'. Then, the state of the algorithm collapses to a state <;' 
with the support disjoint from M, and R^' < 9i?. Thus, we further assume S is disjoint from M . 

Let us consider Steps 5 — 8 of the algorithm. We start with the positive case. Let Pe be a flow from a 
to M with energy at most R. At first, using the Cauchy-Schwarz inequality and that S is disjoint from 
M, we get 



eeE ^ ^eeE ' eeE 



^^^(E^j(E^e)>Eip^i^i- (4) 

Now, we construct an eigenvalue- 1 eigenvector 



«eS eeE V e 

of RbRa having large overlap with <; (assume the orientation of each edge e is from A to B.) Indeed, 
by (HI), (j> is orthogonal to all ^pu, hence, is invariant under the action of both R^ and Rb- Moreover, 
— CiR + J2eeEPe/''^e, and = \/CiR. Since we assumed R > X^eeB Pe/'"'e, we get that the 

normalized vector satisfies 



>^/T^■ (5) 



1 + Ci 



Now consider the negative case. Let w be defined by 



, CiR 

ueS ' e£E 



Let and 11^ be the projectors on the invariant subspaces of Ra and Rb, respectively. Since 5' C A, 
we get that Haw = and Hbw — Hence, by Lemma [2j we have that, if 



C2VI + CiRW 



for some constant C2 > 0, then the overlap of <^ with the eigenvectors of RbRa with phase less than Q 
is at most 1/(2C2). Comparing this with ([S]), we get that it is enough to execute phase estimation with 
precision 6 if Ci and C2 are large enough. Also, assuming Ci > 1, we get Q = i}{l/\/RW) by (g]). □ 



4 Application: Learning Graphs 

As a simple example, we consider an alternative way of implementing learning graphs [?]■ Originally, 
learning graphs were implemented via the dual adversary bound [8, that is later transformed into a 
quantum walk |27l 123) . Although this gives a query-efficient implementation, the time-efficiency of this 
approach is rather unsatisfactory. 

Hence, from the perspective of time-efficiency, it would be preferable to implement a learning graph 
as a quantum walk directly. There was one attempt of doing so in Ref. [12] . The authors use an MNRS- 
type quantum walk |24| . and give quantum walks corresponding to a number of previously developed 
learning graphs. We, however, use the Szegedy-type quantum walk, and our construction is valid for an 
arbitrary learning graph. 

A learning graph can be defined as a special case of a quantum walk from Section [3] A learning 
graph computes a function f : V {0, 1} with V C [g]". Vertices of the graph are subsets of [n], and 
the allowed edges are only between vertices S and S U {j} for some S C [n] and j £ [n] \ S. The initial 
distribution a is concentrated on the vertex 0. For each positive input x € /^^(l), a vertex S is marked if 
and only if it contains a 1-certificate for x, i.e., f{z) = 1 for all z £ V such that zs = xg. The complexity 
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of the learning graph is defined as \/WR in the notations of Section 12.11 It is known [5^ that then the 
quantum query complexity of / is 0{\/W R). We show this again using a quantum walk from Section[31 

The learning graph is a bipartite graph: the part A contains all vertices of even cardinality, and the 
part B contains all vertices of odd cardinality. Also, the support of a is concentrated in A. Hence, 
the algorithm from Section [3] can be applied, and the presence of a marked vertex can be detected in 
0{\/WR) steps of the quantum walk. It suffices to show that one step of the quantum walk can be 
implemented in 0(1) quantum queries. 

This can be done using standard techniques. Let x be an input to / given as an oracle. The quantum 
walk has two registers: the data register D, and the coin register C. The first register can be in a 
state |S')d for some S' C [n]. The register contains the description of the subset S, the values of Xj for 
j € 5', and some ancillary information. Because of the interference, it is important that |5)d is always 
represented in exactly the same way that only depends on S and the input string x. The second register 
stores an element j € [n]. An element |5)D|j)c of the computational basis represents the edge of the 
learning graph connecting subsets S and A {j}, where A is the symmetric difference. Additionally, 
there is the state |0)d for the initial distribution. 

The step of the quantum walk is performed as follows. Start with a superposition of |0) and the 
states of the form |S')d|j)c with S in A. At first, perform the reflection Ra as described in Section[3] It 
is possible to detect whether S is marked by considering the values Xj stored in |S')d, and il^s does not 
depend on the input. Hence, this operation does not require any oracle queries. Next, apply the update 
operation that maps |S')d|j)c into |5' A {j})d|j)c- This represents the same edge, but with the content of 
the data register in B. The update operation requires one oracle query in order to compute or uncompute 
Xj. After that, perform Rb similarly to Ra, and apply the update operation once more. Hence, one 
step of the quantum walk requires 0(1) oracle queries, and f(x) can be computed in 0{\/WR) quantum 
queries. 

5 Application: 3-distinctness 

In Sectional we demonstrated that the quantum walk algorithm from Section[3]can be used to implement 
learning graphs. In this section, we show an application that uses techniques unavailable for ordinary 
learning graphs. 

Consider the fc-distinctness problem (the definition follows shortly) . The first quantum algorithm for 
this problem was constructed by Ambainis [3] using quantum walk on the Johnson graph. This requires 
Qj-j^fc/(fc+i)^ queries and can be implemented in the same time complexity up to polylogarithmic factors. 
For fc = 2, it is tight [1]. 

Recently, the query complexity of the problem was improved to o(ri'^/'*) using a generalized learning 
graph approach 'W . For A; = 3, it gives 0(n^/^) queries. However, it is unknown how to implement the 
algorithm time-efficiently. In this section, we describe a quantum algorithm for 3-distinctness having the 
same time complexity up to polylogarithmic factors. This is a different algorithm from Ref. [6 , and is 
based on ideas from Ref. [8j. Formally, we prove the following result. 

Theorem 5. The 3-distinctness problem can be solved by a quantum algorithm in time 0{n^^'^) using 
quantum random access quantum memory (QRAQM) of size 0(?i^/^). 

Recall that the Ambainis' algorithm consists of two phases: the set-up phase that prepares the 
uniform superposition, and the quantum walk itself. Our algorithm also consists of these two phases. 
Moreover, for fc = 2, it is exactly the Ambainis' algorithm. Interestingly, in our case, the analysis of the 
quantum walk is quite simple, and can be easily generalized to any fc. It is the set-up phase that is hard 
to generalize. The case of fc = 3 has a relatively simple ad hoc solution that we describe in Section 15.31 

During the preparation of the paper, we learned about an alternative time-efficient quantum algorithm 
for the 3-distinctness problem by Andrew Childs, Stacey Jeffery, Robin Kothari and Frederic Magniez 
(personal communication) . They use an MNRS-type quantum walk. Their algorithm has a similar set-up 
phase as ours, but a more complicated quantum walk phase, that is hard to generalize to arbitrary fc. 
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5.1 Technicalities 



We start the section with some notations and algorithmic primitives we need for our algorithm. For 
more detail on the implementation of these primitives, refer to the paper by Ambainis [T. Although 
this paper does not exactly give the primitives we need, it is straight-forward to apply the necessary 
modifications, so we don't go into the detail. 

Some parts of our algorithm work for the general fc-distinctness problem, so we describe the notation 
for this problem. We arc given a string x G [q]''\ A subset J C [n] of size £ is called an (-collision 
iff Xi — Xj for all i,j £ J. In the fc-distinctness problem, the task is to determine whether the given 
input contains a fc-collision. Inputs with a fc-collision are called positives, the remaining ones are called 
negative. 

Without loss of generality, we may assume that any positive input contains exactly one fc-collision. 
Otherwise, one can first try random subinstances of the problem, and this reduction can be made time- 
efficient [4 . Also, we may assume there are f2(n) (fc — l)-collisions by extending the input with dummy 
elements. 

For a subset S C [n] and i £ [fc], let Si denote the set of j e 5 such that G S \ xj' — Xj}\ — i. 
Denote = \Si\/i, and call t — (ri, . . . , rfc) the type of S. 

Our main technical tool is a dynamical quantum data structure that maintains a subset S C [n] and 
the values Xj for j G S. We use notation \S)d to denote a register containing the data structure for a 
particular choice of 5* C [n]. 

The data structure is capable of performing a number of operations in polylogarithmic time. The ini- 
tial state of the data structure is |0)d- The update operation adds or removes an element: \S)D\j)\xj) i-^ 
\S A {j})D|j)|0). Recall that A stands for the symmetric difference. There is a number of query oper- 
ations to the data structure. It is able to give the type r of S. For integers i £ [fc] and £ £ [\Si\], it 
returns the £th element of Si according to some internal ordering. Given an element j £ [n], it detects 
whether it is in S, and if it is, returns the tuple {i,£) such that j is the ^th element of Si. Given a £ [q], 
it returns i £ [fc] such that a equals to a value in Si or says there is no such i. 

The data structure is coherence- friendly, i.e., a subset S will have the same representation \S)d inde- 
pendently of the sequence of update operations that results in this subset. Next, it has an exponentially 
small error probability of failing that can be ignored. Finally, the implementation of this data structure 
requires quantum random access quantum memory (QRAQM) in the terms of Ref. [22j . 

5.2 Quantum Walk 

In this section, we describe the quantum walk part of the algorithm. Formally, it is as follows. 

Lemma 6. Let ri,...,r/j_i = o(n) be positive integers, x £ [(?]" be an input for the k- distinctness 
problem, and Vq be the set of S Q [n] having type (ri, . . . , r^^-i, 0). Given the uniform superposition 
~ ^ X^sgVp l*^).' possible to solve the k-distinctness problem in 0{n/ y/mm{ri, . . . , rk-i}) 



quantum time. 

Proof. As mentioned in Section [5. 11 we may assume that any input contains at most one fc-collision and 
n(n) (fc — l)-collisions. Define = 0, and the type Ti as (ri, . . . , ri„i, -I- 1, r^+i, . . . , r^) for i £ [0, fc]. 
Let Vi be the set of all S C [n] having type r^. It is consistent with our previous notation for Vq. Denote 
V — [JiVi. Also, for i £ [fc], define the set Zi of dead-ends consisting of vertices of the form (5, j) for 
S £V^-i and j £ [n] such that S A {j} ^ V. Again, Z ^[j^Z,. 

The vertex set of G is U Z. Each S £ V \ Vk connected to n vertices: one for each j £ [n]. If 
S A {j} £ V, it is the vertex S A {j}, otherwise, it is {S,j) £ Z. A vertex S £ Vt is connected to fc 
vertices in Vk-i differing from S in one element. Each {S,j) £ Z is only connected to S. The weight of 
each edge is 1. A vertex is marked if and only if it is contained in 14. 

Algorithm [T] is not directly applicable here because we do not know the graph in advance (it depends 
on the input), nor we know the amplitudes in the initial distribution <;. However, we know the graph 
locally, and our ignorance in the amplitudes of <; conveniently cancels out with our ignorance in the size 



Let us briefly describe the implementation of the quantum walk on G following Section [31 Let 
G ~ {V U Z,E) be the graph described above. It is bipartite: The part A contains all Vi and Zi for i 




of G. 
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even, and B contains all Vt and Zi for i odd. The support of <r is contained in A. The reflections Ra and 
Rb are the direct sums of local reflections I?„ over all m in A and B, respectively. They are as follows: 

• If li G Vfc, then Z?„ is the identity in "Hu- 

• If u Cz Zi, then Du negates the amplitude of the only edge incident to u. 

• li u Cz Vi for i < k, then D„ is the reflection about the orthogonal complement of tpu in T-Lu. If 
u G Vqj or u e Vi with i > 0, then ipu is defined as 

respectively. Here, Ci is a constant. 

The space of the algorithm consists of three registers: D, C and Z. The data register D contains the 
data structure for 5 C [n]. The coin register C contains an integer in [0, n], and the qubit Z indicates 
whether the vertex is an element of Z. A combination 15)010)010)2 with S £ Vq indicates a vertex in Vq 
that is used in A combination |S')d| j)c|0)z with j > indicates the edge between S and S A {j} or 
{S,j) £ Z. Finally, a combination |5')D|i)c|l)z indicates the edge between {S,j) £ Z and S £V. 

Similarly to Section 01 the reflections Ra and Rb are broken down into the diffuse and update 
operations. The diffuse operations perform the local reflections in the list above. For the first one, 
do nothing conditioned on \S)d being marked. For the second one, negate the phase conditioned on 
Z containing 1. The third reflection is the Grover diffusion [T^ with one special element if S' G Vq. 
Similarly to Algorithm [1] the orientation of the edges may be ignored because the graph is bipartite. 

The update operation can be performed using the primitives from Section [Ql Given \S)o\j)c\b)z, 
calculate whether S A {j} G in a fresh qubit Y. Conditioned on Y, query the value of Xj and perform 
the update operation for the data structure. Conditioned on Y not being set, flip the value of Z. Finally, 
uncompute the value in Y. On the last step, we use that |S')d|j)c represents an edge between vertices in 
V if and only if \S A {j})D\j)c does the same. 

After we showed how to implement the step of the quantum walk efficiently, let us estimate the 
required number of steps. The argument is very similar to the one in Theorem 01 Let us start with the 
positive case. Assume {ai, . . . ,ak} is the unique fc-coUision. Let Vq denote the set of 5 G Vq that are 
disjoint from {oi, . . . , Ofe}, and a' be the uniform probability distribution on Vq. Define the flow p from 
a' to Vk as follows. For each S £ Vi such that i < k and S M = {ai, . . . , ai}, deflne flow — 1/|V^'| 
on the edge e from 5 to S* U {0^+1} G K+i- Define Pe = for all other edges e. Let 

This vector is orthogonal to all ipu, hence, is invariant under the action of RbRa- Also, = (fc + 

Ci)/|Fo'|, and (0,<;) = VCi/\Vo\. Hence, 

\ii0ii'V y (fc + Ci)iK)rVfc + Ci 

where ^ stands for the asymptotic equivalence as n — ^ 00. 
In the negative case, define 

(e4=i^) + Ei^))- 

Similarly to the proof of Theorem HI we have that H^iui ~ and H^w — 

Let us estimate \\w\\. The number of edges in E is at most n times the number of vertices in 
VqU ■ ■ ■ U Vk-i- Thus, we have to estimate \Vi\ for i £ [fc — 1]. Consider the relation between Vq and Vi 
where S £ Vq and S' £ Vi are in the relation iff S" \ ^ consists of i equal elements. Each element of Vq 
has at most n^^T^) = 0{n) images in Vi because there are at most n maximal collisions in the input, and 
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for each of them, there are at most C^^^) variants to extend 5* with. On the other hand, each element 
in Vi has exactly + 1 preimagcs in Vq. Thus, = 0{n\Vo\/ri). Thus, 

||w|| = O (^y/l + n/ri + n/r2 H h n/rfc_i^ = O (^n/ yjim\i{ri, . . . ,rk-i}^ ■ 

By Lemma m we have that if 6 = i7(l/||w||), then the overlap of <, with the eigenvectors of RbRa with 
phase less than 8 can be made at most I/C2 for any constant C2 > 0. Thus, it is enough to execute 
the phase estimation with precision Q if Ci and C2 are large enough. By Theorem |31 this requires 
0{n/ -y/minlri, . . . , rk-i}) iterations of the quantum walk. □ 



5.3 Preparation of the Initial State 

Now we describe how to generate the uniform superposition over all elements in Vq from the formulation 
of Lemma [6] efficiently in the special case of fc = 3. Let us denote ri — n^^'^ and r2 = n"*/^. We start in 
the assumption the input is negative. 

X /2 " 

rrepare the state (,") J2s:\s\=r, \S)d in time 0{n). This is very similar to the algorithm by 
Ambainis, and we omit the details. Measure the type of S. The state of the algorithm collapses to the 
uniform superposition of the subsets of some type r = (^1,^2)- Unfortunately, with high probability, t2 
will be of order rf/n that is much smaller than the required size r2. 

We enlarge the size of S2 by using the Grover search repeatedly. For each S in the superposition, 
apply the Grover search over [n] . An element j € [n] is marked iff j ^ S* and Xj is equal to an element 
in S'l. This can be tested using the primitives from Section l5.ll If the Grover search fails, repeat it 
from the current state. If the search succeeds, the state is a superpositon of states of the form |S')Db)- 
Query the value of Xj, and update the data structure. This gives a superposition over |5U {j})D\j)- Let 
S' — S U {j}. Apply the primitive that transforms j into its number in 82- This gives a superposition 
over |5')D|i) where i G [\S'2\]- We show in a moment that, for a fixed S', all states |S")d|*) have the same 
amplitude, hence, the second register can be detached. 

A typical subset has ri(ri) elements in Si that can be extended to a 2-collision, hence, the Grover 
search requires 0^\Jnlr\) iterations. As we load 0(r2) additional elements, the time spent during the 
Grover search is 0[r2 \/nlr\). 

Now assume each S contains r2 2-collisions. Unfortunately, the state is not the uniform superposition 
we require for the quantum walk in Lemma [HI But due to symmetry, at any place in the algorithm, 
the amplitude of a subset S only depends on the number of elements in S'l that can be extended to 
a 2-collision. This shows that, indeed, the second register can be detached after the Grover search. 
Moreover, this gives us a way to generate the uniform superposition we require. 

We measure the content of S\ . Let B be the outcome. The state collapses to the uniform superposition 
over subsets ^2 consisting of r2 2-collisions not using the values in B. Then, we repeat the first step, i.e., 
for each S*, we construct the uniform superposition over subsets of size r\ consisting of elements outside 
S2 and having values different from the ones in B. After that, we measure the type of the subset. This 
results in the uniform superposition over states in Vq of type {r'2^r'-^ with r'2 > r2 and r[ = 0{ri) and 
avoiding elements with values in B. 

In the positive case, due to a similar argument, the state can be written as ai;' + — o?^" where 
is the uniform superposition over VJ,' as defined in the proof of Lemma [Bl and ^" is some superposition 
over |S')d where S intersects {01,02,03}. One can show that a is close to 1, hence, the initial state has 
large overlap with eigenvalue- 1 eigenspace of RbRa^ 

Then, we can apply the algorithm from Lemma [B] with additional modification that a vertex (S*, f) 
is declared a dead-end also if Xj has a value in B. This finds a 3-collision in time Oinj ^fFi) if its value 
is different from a value in B. For the values in B, we search for a 2-collision outside B but having a 
value equal to a value in B. This can be implemented in time Oir?!^^ using the standard algorithm for 
2-distinctness with minor modifications. 

Thus, up to polylogarithmic factors, the time complexity of the algorithm is r\ + r2\/n/ri + n/y^. 
This attains optimal value of 0(n^/^) for ri = n^^^ and r2 = n^^^. This finishes the proof of Theorem [SJ 

'^One can modify the algorithm so that it does not require this observation. With probability 1/2, continue with the 
old algorithm, and with probability 1/2, measure the content of S and search for a 2-distinctness outside S having a value 
equal to a value in S. This can be done using the standard algorithm for 2-distinctness with minor modifications. 
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